How to Respond to Patient Reviews Without Violating HIPAA (Templates)

To respond to patient reviews under HIPAA, keep every reply generic: thank the reviewer, never confirm or deny that they're a patient, never repeat a diagnosis, procedure, date, or provider name they mentioned, and move anything specific to a private phone call or email. The confirmation of a treatment relationship is itself protected health information — even a warm, well-meaning reply can disclose it. That last point is the one that catches practices off guard. Most staff think HIPAA risk in review replies is about accidentally mentioning a diagnosis. It's broader than that: simply replying in a way that only makes sense if the person were a patient — "thanks for coming in," "glad your cleaning went well," "sorry your crown took longer than expected" — confirms the treatment relationship to anyone reading the thread, which is a disclosure of PHI regardless of whether any clinical detail follows. Getting HIPAA-careful AI reply drafts for patient reviews right means training the habit out of your front desk before it becomes muscle memory, not just catching it after the fact. Why even a friendly reply can be a HIPAA violation The patient's own privacy doesn't transfer to the practice. If a reviewer writes "my root canal with Dr. [Name] was botched and I had to go elsewhere to fix it," the patient has disclosed their own PHI voluntarily — but the practice responding with anything that references the root canal, the timeline, or the provider confirms the practice's side of that same relationship, and the practice is the covered entity bound by the Privacy Rule, not the reviewer. A reply doesn't need to add new clinical detail to create risk; simply agreeing with, apologizing for, or correcting what the patient already said can still count as confirming and discussing a treatment relationship in public. This is also why "well, they said it first" isn't a defense that holds up. The safer assumption for any practice is that a public review, however detailed, never grants permission to discuss the relationship back — the practice's reply has to stand on its own as something that would make sense even if the person weren't a patient at all. What HHS OCR has actually enforced here This isn't a theoretical risk. HHS's Office for Civil Rights has pursued enforcement actions against dental and medical practices specifically over PHI disclosed in review responses — including a Texas dental practice's replies to Yelp reviews around 2019, reportedly resulting in a settlement in the range of $10,000, and additional cases involving practices responding to online reviews in the years since . The specifics vary, but the pattern across these cases is consistent: a staff member replied to a negative review in a way that confirmed the person was a patient and referenced their care, intending to defend the practice's reputation, and ended up creating a reportable HIPAA breach instead. Given how easily this happens with good intentions, a legal review of your practice's actual reply policy — not just this article — is worth doing before you roll out any templated response process. The rules for any public reply in a dental or medical practice Never confirm or deny the relationship. Don't use language that only makes sense if the person were a patient. Never repeat clinical details the reviewer mentioned. Not the diagnosis, not the procedure, not the provider's name, not the date — even to correct or dispute them. Keep the reply short and generic. Thank them for the feedback, note that you take all feedback seriously, and invite them to reach out directly. Move specifics offline, every time. A phone number or direct email in the reply, with nothing discussed publicly past that point. Have a person approve every reply before it posts. This isn't a step software should skip past — the risk is contextual, and a human needs to read the actual review before anything goes live. Templates for common situations The same neutral structure works across almost every scenario — the goal is a reply that would read exactly the same whether or not the person ever set foot in your practice. General positive review: "Thank you for taking the time to leave this feedback — we really appreciate it." General negative review (tone, wait time, front desk): "Thank you for sharing this. We take all feedback seriously and would welcome the opportunity to discuss it further — please reach out to our office directly at [phone/email] at your convenience." Billing dispute: "We understand billing questions can be frustrating. Please contact our billing department directly at [phone/email] so we can look into this with you." No amounts, codes, or insurance details belong in the public reply, regardless of what the reviewer posted. A review that names a diagnosis or procedure: Use the same general negative-review template above, word for word — do not repeat, confirm, or dispute the specific term the reviewer used, even in passing. The restraint is the point: a reply that carefully avoids a term the reviewer already used in public reads oddly to the reviewer but protects the practice. A review you believe isn't from an actual patient: Avoid confirming or denying any relationship here too — "We were unable to connect this review to a visit at our practice, and we welcome you to reach out directly with any questions" stays neutral. If the review is clearly fabricated or violates a platform's content policy, that's a case for the platform's own reporting process rather than a public back-and-forth. Responding on Yelp specifically The reply rules above apply fully to Yelp — a Yelp reply carries the same HIPAA risk as a Google reply. What's different on Yelp is the request side: Yelp's terms explicitly prohibit asking customers for reviews in any form, so Yelp is a platform you monitor and respond to, never solicit on. If you're building a request process for other platforms, see our guide on how to get more Google reviews for what's safe to do elsewhere, and keep Yelp limited to listening and replying. How Tailwind drafts replies that stay inside the lines Tailwind's AI drafts a reply using the same neutral structure described above — no confirmation of patient status, no repetition of clinical details from the original review . A staff member still reviews and approves every draft before it posts; the tool speeds up getting to a safe first draft, it doesn't replace a person deciding whether that draft is actually safe for this specific review. For a broader negative-review response generator that works the same way across industries, see our negative review response generator. Can we thank a reviewer by name if they signed a privacy release? A specific written authorization from the patient could change what's permissible, but this is a legal question for your own counsel, not a default assumption to build a workflow around. Absent a release, treat every public reply as if no such authorization exists. Should we ever delete or report a review instead of replying? Reporting makes sense when a review clearly violates a platform's content policy — it's from someone who was never a patient, contains threats, or includes another person's private information. A review that's simply negative or unflattering isn't grounds for reporting; that's a case for a calm, neutral reply, not a dispute request. For the request side of this — getting a steady flow of reviews in the first place, without gating or incentives — see how to get more patient reviews for your dental practice, and for the bigger picture of monitoring every platform in one place, see dental reputation management: the complete guide for practices. Every review from Google, Healthgrades, Zocdoc, Vitals and WebMD in one inbox → Try Tailwind free. Tailwind is $5 a month per tool, or $50 a month for the Full plan with every tool included — first month free, no card required.